Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

Microsoft reveals small but vital security upgrade - so patch your devices now

Hand increasing the protection level by turning a knob

Microsoft has released this month’s cumulative cybersecurity update known as Patch Tuesday. It’s one of the smallest updates in terms of the number of flaws addressed, but it has still fixed some important vulnerabilities, so make sure to apply the patch as soon as possible.

In a follow-up security advisory, Microsoft said that it fixed a total of 38 vulnerabilities this month (not including the 11 Microsoft Edge browser flaws fixed a week ago). 

Among them are three zero-days, and six “critical” flaws allowing for remote code execution (RCE). 

Fixing zero-days

Here’s a full breakdown of the update:

  • 8 Elevation of Privilege Vulnerabilities
  • 4 Security Feature Bypass Vulnerabilities
  • 12 Remote Code Execution Vulnerabilities
  • 8 Information Disclosure Vulnerabilities
  • 5 Denial of Service Vulnerabilities
  • 1 Spoofing Vulnerability

Of the three zero-days, two were being actively used in the wild, to attack vulnerable endpoints. Those two are CVE-2023-29336, and CVE-2023-24932. The former is a Win32k Elevation of Privilege Vulnerability, a flaw in the Kernel driver that elevates privileges to the highest level - SYSTEM.

"An attacker who successfully exploited this vulnerability could gain SYSTEM privileges," Microsoft said in its advisory.

The latter is a Secure Boot Security Feature Bypass Vulnerability, which was being used in the wild to install the BlackLotus UEFI bootkit, it was said.

"To exploit the vulnerability, an attacker who has physical access or Administrative rights to a target device could install an affected boot policy," Microsoft further explained.

UEFI bootkits are highly disruptive malware that gets installed on the system firmware, and as such remains on the target endpoint even if the operating system gets reinstalled, or the hard drive replaced. According to BleepingComputer, someone has been selling the BlackLotus bootkit on underground forums since October 2022, and has been actively working on adding new features. Since March, the bootkit was able to bypass Secure Boot on fully patched Windows 11 devices. 

Via: BleepingComputer

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.